Fellow Monastians,

I've always used placeholders, but was wondering about the safety, or not, of concatenating a query statement with column names. So, note the concatenation at the end of $stmt = below:

my $sort_by = ($sort eq 'date') ? 'date_of' : 'user_name';

my $stmt = 'SELECT * FROM time_sheet WHERE user_id = ? ORDER BY '.$sor
+t_by; 
my $user_time = $dbh->selectall_arrayref($stmt, {Slice => {}}, $user_i
+d);
[download]

vs. the long-hand method:

my $stmt;
if ($sort eq 'date') {
   $stmt = 'SELECT * FROM time_sheet WHERE user_id = ? ORDER BY date_o
+f'; 
} else {
   $stmt = 'SELECT * FROM time_sheet WHERE user_id = ? ORDER BY user_n
+ame';
}

my $user_time = $dbh->selectall_arrayref($stmt, {Slice => {}}, $user_i
+d);
[download]

Obviously the first one is a bit more streamlined, but unsure of the safety of it. Thoughts?